1. Technical Field
The invention relates to security and network services. More particularly, the invention relates to a declarative language system used in defining policy for an entire network and in providing monitoring and enforcing of computer network security.
2. Description of the Prior Art
Security administrators need tools that help them formulate their site security policy and translate it into monitoring and enforcement mechanisms. They need to be sure that the computer enforced policyxe2x80x94often cobbled together from a plethora of disjoint access control mechanismsxe2x80x94matches their enterprise policy, all too often specified in a loose natural language or a set of unwritten principles. This leads to confusion as to why access is being granted or denied to particular resources and may lead to unintentional breaches of security.
A way to reduce or eliminate the confusion described above is by providing a user-friendly and, yet, rigorous way of specifying security policy, as well as providing tools for monitoring and enforcing the security policy.
Blaze, Feigenbaum, and Lacy (BFL), Decentralized Trust Management, Proc. IEEE Conference on Security and Privacy (1996), used the term trust management to refer to a problem of deciding whether requested actions, supported by credentials, conform to policies. In other words, it deals with the questions of who, how, and what. Who (the principals, for example, people, computers and organizations) can access what (the resources being sought) and how (the actions performed against the target resources).
Mansouri-Samani, et al, GEM: A Generalized Monitoring Language for Distributed Systems, Distributed Systems Engineering, vol.4, no. 2 96-108 (June 1997) discloses a generalized-event monitoring notation that permits user-specified filtering and composition scripts to be dynamically loaded into distributed-event monitoring components. GEM uses xe2x80x9cscheduled time events and default or user-defined detection windowsxe2x80x9d to cope with xe2x80x9cvariable communication delay problems.xe2x80x9d The GEM event monitoring system is used xe2x80x9cto detect complex event sequences and to convert these into simple eventsxe2x80x9d that trigger management actions. The event monitors have been restricted to performing xe2x80x9cvery simple activities related to triggering or notifying events.xe2x80x9d
J. A. Grompone, A Declarative Language for the Configuration of Exchanges, Telecommunications Journal, vol. 56, no.1 (January 1989) discloses the design and implementation of a high-level language, LEP, to define the routing and customizing of rules of a telex exchange. The routing concepts are basic and few in number. Each of the physical communication paths is called a line. The lines are arranged in groups. The purpose of the LEP language is to provide a comprehensive definition of all lines of an exchange, the arrangement of these lines in groups and the physical attributes of the groups. All groups taken together comprise all the lines without any lines missing or being repeated. A group is an ordered set of lines. The LEP term xe2x80x9caccessxe2x80x9d is used to denote whether lines are permitted or forbidden to access other lines or services. Routing, a basic objective of an LEP program, is a way of associating sets of compiled codes with destinations, done through a sequence of elementary declarations. LEP also defines the possible destinations of a call. One of the main design concepts was to use a very simple structure for the declarations for even users unfamiliar with computer programming.
The LEP language cannot thread together multiple protocol layers of a network event. The LEP language lacks the sophistication in terms of richer expressions to allow a set of policy rules affecting different networking protocols to be applied to a complex protocol interaction between two communicating parties, and to security policy for an entire network. The LEP language does not suggest defining allowed traffic patterns and handling those events that deviate from those patterns.
Plasek, et al, Statistical Database Query Using Random Sampling Of Records, U.S. Pat. No. 5,878,426, discloses a method for obtaining decision support query results from a database table having multiple records. An attribute of the database table is sampled, which results in a collection of sampled data. The sampled data represents some percentage of all of the data corresponding to that attribute in the database table. The data associated with the attribute includes multiple data classes, and the sampled data is separated or partitioned into these data classes. A database query is applied to the sampled data rather than to all of the data corresponding to that attribute in the database table.
Plasek, et al, also discloses a method to obtain decision support query results from a database table where all of the data associated with a particular database attribute is grouped into various data classes. Each of the data classes is individually randomly sampled to obtain a corresponding number of class data samples. Each of the class data samples is then queried, which can include executing aggregation functions on each of the class data samples.
Plasek, et al, also discloses a method for providing result approximations in database queries.
Plasek, et al, does not disclose nor suggest providing a method to select a most specific and applicable result or policy rule. Plasek, et al, does not disclose nor suggest providing a method to rank data and does not order data in a database beyond partitioning data into classes and thereafter randomly sampling each data class such that database queries are applied to each of the samples.
Plasek, et al, does not disclose nor suggest providing a ,method to thread protocol layers of a network event together to provide a result to the network event.
Chow, et al, System, Method, and Program for Extending a SQL Compiler for Handling Control Statements Packaged with SQL Query Statements, U.S. Pat. No. 5,875,334 (Feb. 23, 1999) discloses an integrated compiler for compiling SQL3 control statements having procedural, i.e., control, information packaged together with query, i.e., non-procedural, statements. A query extractor contained within the parser extracts the query statement from the control statement leaving a control skeleton. The query statement is processed as usual through a query compiler for generating executable plans with the exception that the name resolution function for resolving variables is modified for looking up local variables. This modification takes into account the mapping of local and host variables to create a unification of local and host variables. The control skeleton is processed through a control analyzer which generates a representation of the control flow and a scope and symbol table. The control analyzer also unifies the local and host variables. A plan synthesizer then takes as input the control flow information, symbol tables, and individual executable plans for the query statements and generates a meta-plan comprising a merger of a top level plan for the control skeleton and sub-plans representing the executable plans of the query statement.
Chow, et al, does not disclose nor suggest a ranking method or an ordering method to handle a set of rules to be applied to a complex protocol interaction between two communicating parties.
Nor does Chow, et al, disclose or suggest a method whereby to thread protocol layers of a network event together to provide a rule applicable to the network event.
V. Paxson, Bro: A System for Detecting Network Intruders in Real-Time, Network Research Group, Lawrence Berkeley National Laboratory, Berkeley, Calif., LBNL-41197 (January 1998) discloses a stand-alone system for detecting network intruders in real-time by passively monitoring a network link over which the intruder""s traffic transits. The system comprises a xe2x80x9cpolicy script interpreterxe2x80x9d that interprets event handlers written in a specialized language used to express a site""s security policy. The specialized language is C-style because it comprises, for example, C-style data types and constants, operators, and block statements and is procedural. Bro comprises first-class values and aggregate types such as record and table, used to specify a security policy.
However, Paxson does not disclose nor suggest providing a sophisticated ranking method to rank policy rules according to the specificity of the initiator and target communicating hosts and to select a most applicable rule in an efficient manner. Paxson does not disclose nor suggest providing a method to thread protocol layers of a network event together to provide a result to the entire network event.
It would be advantageous to reduce or eliminate the confusion described herein above by providing a user-friendly and, yet, rigorous way of specifying security policy, as well as providing tools for monitoring and enforcing the security policy.
It would be advantageous to have a trust manager that takes as its input a security policy defined as a set of policy rules (statements about trust) and a set of credentials (statements about principals), such that it is capable of processing requests for trust decisions, i.e. evaluating compliance with the policy.
It would be advantageous for the trust manager to have a unified view of an interaction between two principals across a stack of protocol layers, each governed by discreet policy rules, and to apply a final trust decision based on which of these policy rules better fits the entire interaction. For example, using HTTPS to access a secure web page involves an interaction between two network addressable machines (at the TCP/IP level), an interaction between a cryptographically authenticated server and, possibly, a cryptographically authenticated client (at the SSL level), and an interaction between a Web browser (possibly with its own authentication credentials) and a web server, resulting in the retrieval of a web page (at the HTTP level).
It would be advantageous to have a policy definition language as well as well-designed algorithms to support monitoring and auditing network activity, in addition to traditional access/deny authorization decisions. For example, a policy rule might instruct a monitoring Agent to log all traffic between two computers or to decrypt a secure channel between two users.
It would be advantageous to provide a system that comprises a passive monitor of network traffic that does not need to be installed on target hosts or integrated into existing applications.
It would be advantageous to provide a system that uses a sophisticated algorithm for determining which policy rules take precedence over others.
It would be advantageous to provide a policy language that allows a set of policy rules affecting different networking protocols to be applied to a complex protocol interaction between two communicating parties. Also, it would be advantageous to use the policy language to express security policy for an entire network.
It would be advantageous to provide a system, unlike current Intrusion Detection Systems (IDS) which only look for signatures of known attacks, focusing on defining allowed traffic patterns and determining how to handle events that deviate from those patterns.
The invention is a declarative language system and comprises a language as a tool for expressing network security policy in a formalized way. It allows the specification of security policy across a wide variety of networking layers and protocols. Using the language, a security administrator assigns a disposition to each and every network event that can occur in a data communications network. The event""s disposition determines whether the event is allowed (i.e. conforms to the specified policy) or disallowed and what action, if any, should be taken by a system monitor in response to that event. Possible actions include, for example, logging the information into a database, notifying a human operator, and disrupting the offending network traffic.
The language is implemented by a Policy Engine, a component also of a Security Policy Monitoring (SPM) system. The SPM system, also referred to herein as the Policy Monitoring System, is ideally suited for network and security assessments where real network traffic is analyzed in order to identify abnormal traffic patterns, system vulnerabilities and incorrect configuration of computer systems on the network.
Unlike other trust management systems, the SPM is designed to be a passive monitor of network traffic. As such, it need not be installed on target hosts or integrated into existing applications.
The invention provides a simple and intuitive model for expressing and applying security policies. The language is much richer in terms of what it can express than languages used in firewalls and routers. It uses a sophisticated, algorithm for determining which policy rules take precedence over others, a process that in other systems is completely manual.
Unlike existing firewalls and routers, the invention allows a set of policy rules affecting different networking protocols to be applied as a whole to a complex protocol interaction between two communicating parties. Furthermore, networking equipment typically handles only policy related to the network traffic that flows through it. Using the invention herein one can express the security policy for an entire network.
Unlike IDS systems, which look for the signatures of known attacks, the SPM is focused on defining allowed traffic patterns and how to handle events that deviate from those patterns.